Version 5.9.0 breaks ingress configuration that uses default TLS secrets

[bo0ts]

Describe the bug

We currently use the following values for ingress configuration:

    ingress:
      enabled: true
      apiVersion: "networking.k8s.io/v1"
      ingressClassName: <redacted>
      hostName: <redacted>
      tls:
        - {}

This used to work. Since the 5.9.0 chart update the generated ingress is now invalid:

spec:
  # ...
  tls:
    - hosts: null
      secretName: <nil>

Version of Helm and Kubernetes

- Helm: v4.1.1
- Kubernetes: v1.33.5

Chart version

jenkins-5.9.3

What happened?

helm template .

What you expected to happen?

Generate the old ingress, which was valid and worked.

How to reproduce it

Anything else we need to know?

No response

[timja]

cc @lemeurherve

---

and possibly (@hypery2k) not sure if its the tpl.

---

@lemeurherve is there a reason that .Values.controller.ingress.hostName isn't used by default?

[lemeurherve]

@lemeurherve is there a reason that .Values.controller.ingress.hostName isn't used by default?

No particular reason.

[lemeurherve]

Should be fixed with #1634 released as https://github.com/jenkinsci/helm-charts/releases/tag/jenkins-5.9.5

@bo0ts can you confirm please?

[KeepItSimpleStupid]

Hi !

this fix doesn't resolve a diff on the field Ingress.spec.tls.secretName we have between what is generated now and what was generated for 5.9.0 and previous versions

Here is the extract of our values file

controller:
  ingress:
    enabled: true
    ingressClassName: nginx
    hostName: foo.bar.com
    tls:
      - hosts:
        - foo.bar.com

Before : a true <nil>

kind: Ingress
metadata:
  namespace: default
  labels:
    "app.kubernetes.io/name": 'jenkins'
    "app.kubernetes.io/managed-by": "Helm"
    "app.kubernetes.io/instance": "jenkins"
    "app.kubernetes.io/component": "jenkins-controller"
    "helm.sh/chart": "jenkins-5.9.0"
  name: jenkins
spec:
  ingressClassName: "nginx"
  rules:
  - http:
      paths:
      - backend:
          service:
            name: jenkins
            port:
              number: 8080
        pathType: ImplementationSpecific
    host: "foo.bar.com"
  tls:
  - hosts:
      - "foo.bar.com"
    secretName:

After : a <nil> but as a string

kind: Ingress
metadata:
  namespace: default
  labels:
    "app.kubernetes.io/name": 'jenkins'
    "app.kubernetes.io/managed-by": "Helm"
    "app.kubernetes.io/instance": "jenkins"
    "app.kubernetes.io/component": "jenkins-controller"
    "helm.sh/chart": "jenkins-5.9.5"
  name: jenkins
spec:
  ingressClassName: "nginx"
  rules:
  - http:
      paths:
      - backend:
          service:
            name: jenkins
            port:
              number: 8080
        pathType: ImplementationSpecific
    host: "foo.bar.com"
  tls:
  - hosts:
      - "foo.bar.com"
    secretName: "<nil>"

We don't specify the secretName because we want ingress-nginx to use its default certificate specified in the controller config.

We'd rather not have the secretName field at all in our case, but it works also with a true <nil> value

[lemeurherve]

@KeepItSimpleStupid reproduced the issue with >=5.9.0, but not exactly your before:

$ git checkout jenkins-5.8.127
$ cat test2.yaml 
controller:
  ingress:
    enabled: true
    ingressClassName: nginx
    hostName: foo.bar.com
    tls:
      - hosts:
        - foo.bar.com

$ helm template . --values test2.yaml > test-template2.yaml

---
# Source: jenkins/templates/jenkins-controller-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: default
  labels:
    "app.kubernetes.io/name": 'jenkins'
    "app.kubernetes.io/managed-by": "Helm"
    "app.kubernetes.io/instance": "release-name"
    "app.kubernetes.io/component": "jenkins-controller"
    "helm.sh/chart": "jenkins-5.8.127"
  name: release-name-jenkins
spec:
  ingressClassName: "nginx"
  rules:
  - http:
      paths:
      - backend:
          service:
            name: release-name-jenkins
            port:
              number: 8080
        pathType: ImplementationSpecific
    host: "foo.bar.com"
  tls:
    - hosts:
      - foo.bar.com
---

No secretName generated at all before.

Preparing a PR with a fix.

[lemeurherve]

Preparing a PR with a fix.

• fix: don't add secretName: "<nil>" to ingress if no value defined #1635

[KeepItSimpleStupid]

@lemeurherve : You're right ! The timeline is a bit more complex

• pre 5.8.128 : no secretName added
• 5.8.128 (included) to 5.9.1 (excluded) : secretName added with a true <nil> value (that we didn't notice because it was still accepted by ingress-nginx)
• 5.9.1 and newer : secretName added with a <nil> value as a string

Since you used the chart version 5.8.127 in your repro, you were in the first case

[lemeurherve]

@KeepItSimpleStupid fix released in https://github.com/jenkinsci/helm-charts/releases/tag/jenkins-5.9.6

Can you confirm it resolved your issue please?

[KeepItSimpleStupid]

@lemeurherve : yes, all good ! The secretName is removed as expected.

Thank you :)

[lemeurherve]

Cool 🙂

Closing as completed then.